Proof of Concept (POC)

CVE-2024-23443

hp_bios_osquery

Adicionar extensão osqery HP BIOS WMI ao Elastic Agent

Dependências

• pip install pywin32
• pip install osquery
• pip install pyinstaller

Compilação

pyinstaller --onefile hp_bios_enumeration.py

Instalação

1. Copie a extensão para o local do Elastic Agent

   copy .\hp_bios_enumeration.exe "C:\Program Files\Elastic\Agent\data\elastic-agent-XXXXXX\components\"

2. Atualize o arquivo auto_load do osquery no Elastic Agent

   "C:\Program Files\Elastic\Agent\data\elastic-agent-XXXXXX\components\hp_bios_enumeration.exe" | Out-File "C:\Program Files\Elastic\Agent\data\elastic-agent-XXXXXX\run\osquery-default\osquery\osquery.autoload" -Append

3. Reinicie o agente

4. Confirme que a extensão está carregada

   osqueryi

   osquery> SELECT * FROM hp_bios_enum;

   name	possible_values	current_value
   System Management Command	Disable, Enable	Enable
   Fast Boot	Disable, Enable	Enable
   BIOS Rollback Policy	Unrestricted Rollback to older BIOS, Restricted Rollback to older BIOS	Unrestricted Rollback to older BIOS
   Audio Alerts During Boot	Disable, Enable	Enable